Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-3242 Stored XSS Vulnerability in Concrete CMS Versions Below 9.4.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3242
Post summary
The text discloses CVE-2026-3242 as a stored XSS vulnerability affecting Concrete CMS versions below 9.4.8, without mentioning exploitation, PoC, or patch details.
⚡ New CVE Alert: CVE-2026-3242 📊 Severity: 4.8 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-3242 #CVE-2026-3242 #CVE #Medium #CyberSecurity #InfoSec https://t.co/JizZsO1XSE
Post summary
A new CVE‑2026‑3242 is disclosed with a medium risk severity of 4.8 affecting multiple unspecified products, but no additional technical specifics, PoC, or patch information are provided.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3242 - Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block Intel Report: https://ift.tt/rqxzOFB
Post summary
Concrete CMS versions below 9.4.8 are vulnerable to stored XSS via the Switch Language block, as reported in CVE-2026-3242.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | concretecms | concrete_cms | - | - | - |